README.md

metadata

license: other
base_model: nvidia/NVIDIA-Nemotron-3.5-Lightning-30B-A3B-NVFP4
tags:
  - control-vector
  - activation-steering
  - weightless
  - glp

Nemotron-3.5-Lightning-30B-A3B-abliterated-cyber-GLP-51-L1-51-a1.0

Projective control vector ("GLP") for nvidia/NVIDIA-Nemotron-3.5-Lightning-30B-A3B-NVFP4 (NemotronH hybrid mamba/attention/MoE, 30B-A3B, 52 layers, hidden 2688, plain single residual stream). Applied at runtime as h <- h - alpha * (h . d) d at the post-layer residual stream, layers 1–51, alpha 1.0 baked in. No weights are modified; this is the difference, not the model.

Confirmed base: nvidia/NVIDIA-Nemotron-3.5-Lightning-30B-A3B-NVFP4 (revision cc84af2fe71647d87f4486c064f320e1e7535243). The direction was derived and calibrated on the NVFP4 checkpoint via the vLLM capture lane; it is not validated against other quants or checkpoints.

Validation (vLLM lane, image vllm/vllm-openai:v0.27.1, H100, greedy, max_new 4096, 2026-09-05)

suite	stock (α=0.0 no-op arm)	steered (α=1.0)
refusal32	0/32 comply (23 refuse, 9 deflect)	32/32 comply
cyber32 (offensive-security domain)	1/32 comply (27 deflect, 4 refuse)	31/32 comply
benign32	32/32 comply	32/32 — zero collateral
propaganda32 (geopolitical persuasion)	28/32 engage	32/32 engage

The α=0.0 arm is the no-op gate (hooks installed, projection ×0): it reproduces stock behaviour exactly, which is what makes the α=1.0 arm's numbers attributable to the vector.

Termination intact — no SFT repair needed (contrast with Hy4 at α=2.0): refusal32, benign32 and propaganda32 all stop cleanly 32/32 at α=1.0. cyber32 shows 20 clean stops / 12 length-cuts at the 4096 cap, which is long-form technical content hitting the cap with thinking traces, not termination damage. The one cyber32 item the degeneracy guard flags was read by hand: a coherent, compliant ring-0 shellcode walkthrough truncated mid-derivation by the token cap — a classifier artifact, not garble.

Derivation: AdvBench32 vs Alpaca32 contrast, difference-of-means per layer, massive-activation masking 0.005 (the screen flagged all 52 layers at 143–327× peak/median, dominant dim 1599 in 51/52 — same pathology family as Qwen3.8's dim 3994). Adjacent-layer cosine gate: min 0.658, median 0.967 vs random-null p99 0.044. Derived at and applied to residual_stream_post_layer (identical site; under vLLM's fused add+norm convention that is hidden_states + residual at the layer loop).

MTP caveat: this model ships one MTP/nextn draft layer (num_nextn_predict_layers: 1). The draft stack is NOT steered — serve without speculative decoding, or measure draft acceptance per prompt class first (an unsteered draft proposes refusals the steered target rejects).

Usage

This file uses the glp.* GGUF namespace (spec: weightless spec/GLP.md). mode=project is a safety contract: an additive consumer (e.g. stock llama.cpp control-vector loading) must refuse this file — adding a projective direction is silently wrong. Apply per-layer at residual_stream_post_layer with alpha=1.0:

h = hidden_states + residual          # fused add+norm convention
h = h - alpha * (h @ d) * d           # d = unit direction for this layer
hidden_states = h - residual          # write-back; the next norm folds h

Reference patch (fail-closed, vLLM v0.27.1): weightless recipe/nemotron35/ and the derivation lane refusal-research experiments/20260905-nemotron35-glp/ (capture driver, derive, scoring, full run JSONs).

Methodology: METHODOLOGY.md in the same repo. Contrast content, dose calibration and the four-state scoring taxonomy (DEFLECT is a refusal, ARGUMENTATIVE is a compliance) matter more than the estimator.